Privacy Policy

Our privacy obligations depend on whose information is involved, and the distinction matters throughout this policy.

• We are the controller of information about our own users: the person who signs up, their account credentials, their profile, and their use of the Service. This policy governs that information.
• We are a processor of the customer data you put into the Service, including records about your leads, prospects, and contacts. You decide what to collect, why, and how long to keep it. We process it on your instructions in order to provide the Service. If you are one of our customers' contacts and want your information corrected or deleted, please contact that business directly, since they control it. We will assist them in responding.

Information you provide directly.

• Account information. Your email address and a password. Passwords are salted and hashed by our authentication provider; we never receive or store your password in readable form.
• Profile information. Your name, job title, LinkedIn profile URL, headshot image link, and your team or company name, where you choose to supply them.
• Customer data. The records you create or import, including contact names, business names, email addresses, telephone numbers, deal values, pipeline stages, next steps, notes, and logged activity such as calls, emails, texts, and meetings. You control the contents of these records.
• Communications. Messages you send us for support or other enquiries.

Information from third-party sign-in. If you sign in using Google or LinkedIn, that provider sends us your name, email address, profile picture, and a unique identifier. We do not receive your password for those accounts and we do not post anything to them. You may instead sign in with an email address and password and skip this entirely.

Information collected automatically. Our hosting and infrastructure providers record standard server logs, including IP address, browser type, pages requested, and timestamps, which are used for security, abuse prevention, and diagnosing faults.

What we do not collect. We do not run advertising networks, third-party analytics, session recording, or cross-site tracking on the Service. We do not connect to your email inbox and we do not read your email. We do not knowingly collect information from anyone under 18.

• To provide, operate, and maintain the Service and its features.
• To create and authenticate your account and keep you signed in.
• To send transactional messages such as sign-up confirmations, password resets, and notices about security or material changes to the Service.
• To respond to your support requests.
• To monitor for, investigate, and prevent fraud, abuse, and security incidents.
• To understand which features are used so we can improve the Service, using aggregated information that does not identify any individual.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use your customer data to train machine learning models, and we do not use it for any purpose other than providing the Service to you.

Where the General Data Protection Regulation or the UK GDPR applies, we rely on the following legal bases: performance of a contract, to provide the Service you have signed up for; our legitimate interests, in securing the Service, preventing abuse, and improving our product, balanced against your rights; compliance with a legal obligation; and consent, where we ask for it, which you may withdraw at any time.

We disclose personal information only as described below. We do not sell it, rent it, or trade it.

• Members of your team. Everyone in your workspace can see the records in that workspace, along with your name, job title, and headshot. There are no per-user visibility restrictions within a workspace.
• Service providers (subprocessors). The vendors listed below process information on our behalf under contractual confidentiality and security obligations.
• Legal and safety. Where we reasonably believe disclosure is required by law, subpoena, or other legal process, or is necessary to protect the rights, property, or safety of SumoLab, our users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to the acquirer honoring this policy for previously collected information. We will give notice before your information becomes subject to a different policy.

Current subprocessors:

We will update this list before adding a new subprocessor that processes personal information.

We use strictly necessary cookies only. These store your authentication session so you stay signed in and remain secure while moving between pages, and they retain small interface preferences such as whether your sidebar is collapsed. We do not use advertising, analytics, or tracking cookies, which is why the Service does not display a cookie consent banner. Blocking essential cookies will prevent you from signing in.

We are based in the United States and our providers operate in the United States and Canada. If you access the Service from outside those countries, your information will be transferred to and processed there, where data protection laws may differ from those in your jurisdiction. Where required, we rely on the European Commission's Standard Contractual Clauses or an equivalent transfer mechanism.

We retain account and profile information for as long as your account is active. Customer data is retained until you delete it or until your account is closed. When you close your account, we delete or irreversibly anonymize the associated data within 30 days, except where we must retain records to comply with a legal obligation, resolve a dispute, or enforce our agreements. Backups are purged on a rolling schedule not exceeding 90 days. You can export your data at any time before closing an account, and we will assist if you need help doing so.

We use technical and organizational measures appropriate to the risk, including encryption in transit using TLS, encryption at rest for stored data, hashed passwords, access controls scoped so that a workspace can reach only its own records, and infrastructure operated by established providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any relevant regulator as required by applicable law.

Depending on where you live, you may have some or all of the following rights regarding personal information we hold about you as controller:

• Access a copy of your personal information.
• Correct information that is inaccurate or incomplete.
• Delete your personal information.
• Port your information to another service in a machine-readable format.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Be free from discrimination for exercising any of these rights.

You can update your name, job title, LinkedIn URL, and headshot at any time from the profile screen inside the Service. For anything else, email us at info@sumolab.co. We will respond within the period required by applicable law, generally 30 days, and we may need to verify your identity first. An authorized agent may submit a request on your behalf with proof of authority. Residents of the European Economic Area and the United Kingdom may also lodge a complaint with their local supervisory authority.

The Service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy from time to time. If we make a material change, we will revise the effective date above and notify account holders by email or through a notice in the Service before the change takes effect. Your continued use of the Service after an update constitutes acceptance of the revised policy.

Questions, requests, or complaints about this policy or our handling of personal information can be sent to:

See also our Terms of Service.